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Includes CAO Review feedback 


COURSE: -FSHSIZNF) OVSC1205 Special Training on FISA (Analytical) 
COURSE: GSHSIANF) OVSC1206 Special Training on FISA (Technical) 
Module 4: (FSHSH/NE) Access, Sharing, Dissemination, and Retention Under the BR and PR/TT FISC Orders 


DATE/PREPARER: SLS Topic Page Classification Screen Number 
(U) Module FOP-SECRETIC OMA TINOEORS 1 of 27 
Introduction 


FRAME ID: 4010 


(U) Module 4 


NEXT FRAME ID: 4020 (FSHSWINE) Access, Sharing, Dissemination, and Retention Under the BR and PR/TT 
FISC Orders 


(U) This module will enable you to: 
(FSHSHANF) Distinguish between the analysts authorized to query BR and PR/TT 


metadata and those authorized to view query results 


GRAPHIC/AV: (FSHSIYNF) Recognize the contact chaining restrictions for RAS-approved 
(U) Image of OGC Attorney, HMC identifiers 
Character, and SV Character sitting at a 


table (FSHSH/NF) Recognize what constitutes unique BR and PR/TT query results 
(FSHSH/NF) Identify limitations that impact the access, sharing, dissemination, and 
retention of BR and PR/TT query results 
(FSHSH/NF) Recognize the BR and PR/TT dissemination tracking requirement and 
the additional CT nexus requirement for U.S. person identifiers 


BACK FRAME ID: n/a 


Derived From: NSA/CSSM 1-52 
Dated: 20070108 
Declassify On:26360101 
FOR SECREHSLNOFORA. 
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(FSHSHINE) (OGC Attorney): During this part of our trip we will identify the limitations regarding access, sharing, disseminating, and retaining of BR and 
PR/TT query results. 


(U) This module will enable you to: 
e (FSHSIHNF) Distinguish between the analysts authorized to query BR and PR/TT metadata and those authorized to view query results 
e (FSHSHNE) Recognize the contact chaining restrictions for RAS-approved identifiers 
e (FSHSIHNE) Recognize what constitutes unique BR and PR/TT query results 
e §6(FSHSHANE) Identify limitations that impact the access, sharing, dissemination, and retention of BR and PR/TT query results 
e (FSHSHNE) Recognize the BR and PR/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 


(FSHSHANE) If you are a technical person, you might be asking yourself if this information is directly applicable to you and your team. Compliance with the 
FISC Orders could be jeopardized by inadvertent or unintended changes in the infrastructure maintained by technical personnel. Therefore, an 
understanding of the requirements outlined in the Orders is important in the event that any technical support functions (data access, presentation, 
underlying system support — both hardware and software, etc.) cause changes to the support infrastructure that would bring NSA’s compliance with the BR 
and PR/TT Court Orders into question. 


FOPSEEREHSHNOFORN 
Page 2 of 39 


DATE/PREPARER: SLS Topic Page Classification Screen Number 
(FSHSIZNE) BR and PR/TT FOR-SEGRETHICOMINTINOFORN 2 of 27 
Data Access and 
Governance 


FRAME ID: 4020 
(FSHSIZNE) BR and PR/TT Credentials — who can query, who can view results 


(FSHSHANF) Access to BR and PRAT raw 

NEXT FRAME ID: 4025 metadata and query results is restricted to those 
who have the required training and appropriate 
credentials 


BACK FRAME ID: 4010 


ALT TAG: 


GRAPHIC/AV: 

(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 


(FSHSHINE) (SV Character): Access to BR and PR/TT raw metadata and query results is restricted to those who have the required training and appropriate 
credentials. The Office of the Director of Compliance (ODOC) through the Signals Intelligence Directorate’s Office of Oversight and Compliance (SV) 
controls access to the BR and PR/TT FISA metadata, ensuring that only those who have completed all of the required training and have been granted the 
appropriate credentials are permitted to touch the metadata. 


(FSHSHINE) Within the analyst workforce, a distinction is made between individuals who are permitted to aie the data and those who are permitted only 


to view the query results. Individuals who are authorized to query BR and PR/TT metadata sets have credentials. Division level 
management within a production center determines when query permissions will be granted to analysts based on a mission need, not solely on completion 
of BR and PR/TT FISA Training. Some technical personnel may also require query access, but their queries are for the purposes of data accuracy and 
integrity, not for target or intelligence analysis. Managers of technical personnel who require query permissions will make the determination in concert with 
their organization’s compliance office, usually either SV or TV (the Technology Directorate’s office of compliance). 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(FSHSIANF) BR and PR/TT Data FOR 3 of 27 
Access and Governance SESRETHICOMISTHINOEORN 


FRAME ID: 4025 
(TS//SI/INF) How Do I Determine Who Has the Proper Credentials? 


E (= ——_ 5 . 
(U) Type mmm o access EE and check credentials. 
I i 


NEXT FRAME ID: 4030 


BACK FRAME ID: 4020 
ALT TAG: 


GRAPHIC/AV: 
(UH#FOYO) View of EEO r images 
pertinent to checking for credentials 


(FS#SHNE) (SV Character): So, how do you determine if an analyst or technical colleague has the appropriate credentials? SE s a tool that can 
help vou check someone else's credentials against your own. From your NSANet machine, wa your web browser. This takes you to the 


Lookup Utility. Insert the sid of the analyst or technical person you're working with and hit search, the formal accesses you 
share in common are displayed. From that you can determine if they hold — If the utility is not functioning for 


some reason, you should contact SV4 to verify the individual’s credentials before proceeding. 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(FSHSHANF) BR and PRATT Data FOR 4 of 27 
Access and Governance SESRETHICOMIMHINOFORN 


FRAME ID: 4030 
(U) Auditing and Access 


(FSHSHANE) The Court Orders require that when the metadata is queried for intelligence 
analysis purposes that an auditable record be generated. 


(FSHSHANF) The BE aucit log includes: 
e Query requests 
e User login 
e IP address 
« Date and time of the access 


NEXT FRAME ID: 4040 


BACK FRAME ID: 4025 


ALT TAG: 


GRAPHIC/AV: 

(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 


(FSHSH/NF) What is the EAR and how does it function as a compliance safeguard? 


(FSHSHANE) (SV Character): The BR and PR/TT Court Orders require that an auditable record be generated whenever metadata is queried for intelligence 
analysis purposes. When tharaw BR and PR/TT metadata is queried in| EE Han automatic audit log is generated to enable appropriate oversight of— Comment [SL51]: Note for audio recording, this 
these Authorities. SV audits HG performed by both analysts and technical personnel and reviews the following on a periodic basis: is pronounced as a wordl 

e Query requests 

e User login 

e Internet Protocol (IP) address 

e Date and time of the access 


ae While these audits are one way to verify that only RAS-approved identifiers are used as seeds to query the BR and PR/TT 
metadata, HEE the analytic tool used to query this metadata, employs an Emphatic Access Restriction (EAR) software to provide reasonable __..----| Comment [SLS2]: Note for audio recording, this 
assurance that only RAS-approved identifiers are queried by analysts. While the EAR is of great benefit for analysts, it should not lessen awareness and | is pronounced as a word “EAR” (not as letters) 


attention to detail while using the NSA tools and applications associated with BR and PR/TT. We'll discuss the EAR in greater detail later in this module. 
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DATE/PREPARER: SLS Topic Page Classification Screen Number 
(FSHSHNE) BR and PRATT Data FOR 5 of 27 
Access and Governance SECRETICOMISTHINOEORN 


FRAME ID: 4040 
(FSHSHINE) Sourcing of BR and PR/TT Metadata Records 


(FSHSHNE) Within NSA’s source systems of record, BR and PR/TT metadata records are 
tagged as to their origin, which allows for: 
NEXT FRAME ID: 4050 e Determining if information is derived from the BR or PR/TT repository 
e Software and other management controls to function properly 


BACK FRAME ID: 4030 
ALT TAG: 


GRAPHIC/AV: 

(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 


(FSHSWHNE) (OGC Attorney): Another aspect of data access and governance is the requirement for the sourcing of BR and PR/TT metadata records. As we 
mentioned in Module 2, the metadata must carry unique markings, or tags. These tags allow the analyst to determine if a particular piece of information is 
derived from either the BR or PR/TT repository. In addition, these markings enable the EAR software and other management controls to function properly. 


FOR SECRETE NOFORS 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Knowledge FOP SEGRETICOMINTYINSESRN 6 of 27 
Check 1 


FRAME ID: 4050 (U) Knowledge Check 1 


1. (FSHSIANEF) Identify the individuals or groups below who are authorized to receive and view results of 
NEXT FRAME ID: 4060 queries that contain BR and/or PR/TT data (please check all that apply). 
a) Individuals wit credentials 
b) HMCs with il and analysts with | iii 
BACK FRAME ID: 4040 c) Technical personnel with credentials 
d) Your office chief and oversight personnel by virtue of their positional responsibility 
ALT TAG: e) None of the above 


GRAPHIC/AV: 


2. (FSHSHINF) What should you do before sharing the results of a BR or PR/TT query with a co-worker 


working on a target reasonably believed to be associated with the 4 
a) Read your e-mail to see if your co-worker asked you Tor the information 


b) Call one of the SOOs in the NSOC to find out if information about your target can be 
released to your co-worker 

c) Verify that the co-worker has the proper credentials to have access to BR and PRITT 
information 

d) All of the above 


(U) (SV Character): Let’s check in and make a few quick notes in our travel journal and see what we remember from this topic. 


ANSWERS: 

Question 1. (FSHSHNE) Correct! a), b), and c) describe individuals and groups holding O ecentiais. 

(FSHSHNE) Incorrect. Positional authority does not supersede the requirement to have these specific credentials. Not all managers or SV personnel may 
require these credentials for their specific jobs. The correct answers are a), b), and c). 


Question 2. (FS#SHNE) Correct! Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the proper 
credentials to have access to BR and PR/TT information. 

CFSHSHNE) Incorrect, The answer is c). Before you share any BR or PR/TT query results with a co-worker, you must first verify that he or she has the 
proper credentials to have access to BR and PR/TT information. 
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DATE/PREPARER: Topic Page Classification Screen Number 
(FSHSIANEF) Querying the TOP SESRETICOMNTINOEORN, 7 of 27 
BR and PR/TT Metadata 


FRAME ID: 4060 
(FSHSHANE) Analyst Queries of the BR and PR/TT Metadata 


(U) Have RAS, will query? How? 


NEXT FRAME ID: 4070 (FSHSH/NF) How do | recognize BR and or PR/TT results, and what are ”unique” results? 


(U) Once | have results, how do | handle them? Are there any restrictions? 


BACK FRAME ID: 4050 
ALT TAG: 


GRAPHIC/AV: 

(U) Display and fade out the questions 
shown as an intro to the topics to be 
covered in this section. 


(U) For the transcript paragraph spoken by 

the Technical Character, consider using a 

creative treatment that shows the character 

for a brief period and then fades her out 

(perhaps a news bulletin or a postcard??). 

(FSHSHANE) (HMC Character): In this section of the module, we'll cover how analysts query the BR and PR/TT metadata. In addition, we'll go into detail on 
what constitutes BR and PR/TT results and how to tell if they are unique. Since BR and PR/TT unique results may only be shared with individuals who 
have the proper credentials, being able to identify unique BR and PR/TT query results will help you comply with the sharing and handling restrictions. 


(FSHSIHNEF) (Technical Character): While this section may appear to be more focused on analytic-specific tools, certain technical personnel also query 
these datasets to provide reasonable assurance of data integrity or to make the metadata usable for intelligence analysis. Therefore, technical personnel 
and their managers should also be aware of guidelines related to queries, handling instructions for query results, in any form, and the requirements related 
to sharing of unique query results, in any form. 
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DATE/PREPARER: Topic Page Classification Screen Number 
(FSHSIANEF) Querying the TOP SESRETICOMINTIMNOEORN 8 of 27 
BR and PR/TT Metadata 


FRAME ID: 4070 


(FSHSHNE) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 


NEXT FRAME ID: 4075 
(TS//SI//NF) Queries of BR and PR/TT metadata are conducted through fi the user 


interface to As a default, queries are federated with data from other collection 
sources. 


GRAPHIC/AV: 


PENREGIS TAY Mode 
HSABR Mode 
Normal Mode 


? (¥)FISABR Mode 
Ea! 


[Ed] Z 


(FSHSHINE) (HMC iii RAS approved, an identifier can be used to query the BR and/or PR/TT metadata via authorized versions of 

the user interface to When launching mE analysts with the appropriate BR or PR/TT credentials have the option to check a box if the 

wish to include BR or PR/TT metadata in their queries. If an analyst checks the “FISABR Mode” or “PENREGISTRY Mode” box when logging into omment [SLS3}]: Note for audio recording, this 
will perform a federated query. This means that in addition to either BR or PR/TT metadata, ill also query data collected under should be pronounced as the word FISA then the 

additional collection authorities, depending on the analyst’s credentials. Therefore, when performing a query of the BR or PR/TT metadata, analysts will (letters B R. so simply “FISA BR” 

potentially receive results from all of the above collection sources. Users of more recent versions of iii- have the option, however, to “unfederate” 


the query, and pick and choose amongst the collection sources that they would like to query. Comment [a4]: See Screenshot 1. 
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DATE/PREPARER: Topic Page Classification Screen Number 
(FSHSHNE) Querying the TOP SESRETICOMNTINOEORN, 9 of 27 
BR and PR/TT Metadata 


FRAME ID: 4075 
(FSHSHANE) How are Analyst Queries of the BR and PR/TT Metadata Conducted? 


NEXT FRAME ID: 4077 


BACK FRAME ID: 4070 
ALT TAG: 


GRAPHIC/AV: 
(U) Look at Annie’s notes and match 
transcript to screen shots. 


(FSHSHANE) (HMC Character): Once you are operating within the BR or PR/TT mode of HE remember that you may only use a RAS-approved 
identifier to query the metadata. A RAS-approved identifier that is used to initiate a query of BR or PR/TT metadata is referred to as a “seed” since it is 
being used to produce a “chain” of metadata contacts, known as contact chaining. 


(FSHSIHNE) BE y- the EAR software to provide reasonable assurance that only RAS-approved identifiers are queried by analysts. Before 
executing a query on an identifier, the EAR verifies that the identifier is RAS-approved. If an analyst attempts to query a non-RAS-approved identifier while 
still in BR or PR/TT query mode, the EAR will provide reasonable assurance that no results are returned for that query; this includes data not derived from 
BR or PRITT. This query will, however. be reflected in SV's auditing and a justification for the query attempt may be requested. If you are unsure whether 
an identifier is RAS-approved, use ME: o determine the identifiers approval status. 


FOPSEEREHHSHNOFORN 
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DATE/PREPARER: 


FRAME ID: 4077 


NEXT FRAME ID: 4080 


Topic 
(FSHSIANF)-Querying the 
BR and PR/TT Metadata 


Page Classification 
FOP SEGRETYICOMINTHINOFORN 


Screen Number 
10 of 27 


(TS//SI//NF) Contact Chaining with BR and PR/TT metadata 


BACK FRAME ID: 4075 
ALT TAG: 


GRAPHIC/AV: 
(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table m 

(U) Look at notes and match 
transcript to screen shots. 

(FSHSIHENE) Create animation to explain 
the following: While the BR Order permits 
contact chaining for up to three hops, NSA 
has decided to limit contact chaining to only 
two hops away from the RAS-approved 
identifier without prior approval from your 
Division management to chain the third 
hop. Under PR/TT, the FISC limits the 
number of hops for internet 
communications to only two, and the hop 
counter will not permit these FISC- 
mandated levels to be exceeded 


(FSHSIVNE) (HMC Character): Once the EAR verifies that the seed that the analyst has requested to query is RAS approved, it will allow the analyst to 


FOPSEEREHSHNOFORN 
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from a RAS-approved identifier. For example, let's say your target calls an associate === ma That associate then calls several En 
this example it is one hop from your RAS-approved identifier to the associate and anotner nop trom tne associate to a recruit. In other words, the associate 


is a “first hop” contact of your target, and the rce “second hop” contacts. 
$ Comment [a5]: We can probably use some of the 
existing screenshots we made to also illustrate the 
hops. 


‘chain’ on that identifier. In the BR and PR/TT Orders, the FISC sets limits on how extensive this — a be. We refer to this as the number of hops 


(FSHSIANEF) (OGC Attorney): While! the BR Order permits contact chaining for up to three hops, NSA has decided to limit contact chaining to only two hop 
away from the RAS-approved identifier without prior approval from your Division management to chain the third hop. Under PR/TT, the FISC limits the 
number of hops for internet communications to only two. Technical controls will not permit these FISC-mandated hop levels to be exceeded. 


(FSHSIANE) (HMC Character): If another RAS-approved identifier is encountered within the authorized number of hops from the previous RAS-approved 
identifier, the number of hops resets to allow a contact chain to be generated out the authorized number of hops from the newly encountered RAS- 
approved identifier. 
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Topic Page Classification Screen Number 
DATE/PREPARER: (FSHSHNE) Querying the FOP SEGRE HICOMINTINOFORN. 11 of 27 
BR and PR/TT Metadata 


FRAME ID: 4080 


(FSHSHNE) What is a Query Result and how do | know if it is a BR or PR/TT Query 
Result? 


(FSHSIANF) Query Result: Queries produce results in the form of a contact chain 

presented in ormat; each chain is comprised of individual contacts derived from data 

returned from the multiple collection sources queried. Each contact/line within a chain 

represents an individual result. Comment [a6]: This is illustrated by screenshot 2 


NEXT FRAME ID: 4090 


BACK FRAME ID: 4077 
ALT TAG: 


GRAPHIC/AV: 
(U) Look at Hii notes and match 
transcript to screen shots. 


(FSHSHNE) (HMC Character): When you query a RAS-approved identifier in In BR or PR/TT modes, [Will return a Mie, usually 
referred to as a chain, which is made up of the individual first hop contacts of the seed. Bearing in mind the hop restrictions just discussed, analysts may do 


further chaining on those contacts. Each of these contacts, or line within the chain, represents an individual result. Remember, unless vou choose to Comment [a7]: This is illustrated by screenshot 2 
unfederate your query as we described earlier, these results may have been obtained under a variety of collection authorities. 
(FSHSIHNE) It is possible to determine the collection source or sources of each result within the chain by examining the Producer Designator Digraph 


(PDDG)/SIGINT Activity Designator (SIGAD) and collection source(s) at the end of the line. _..----7-| Comment [SLS8]: Note for audio recording, this 
should be pronounced as a word “SIGAD” (not 

(FSHSHINE) If at least one source of a result is BR or PR/TT metadata, the classification at the beginning of the line will contain the phrases FISABR or (spelled out in letters as STG A D) 

PR/TT, respectively. In addition, in the source information at the end of the line, the $|GAD = ES R data can be ] Comment [a9]: really think we need some 

recognized by SIGADs beginning with = -or PR/TT, data pictures to illustrate. 

collected after October 2010 is found es o a 

comprehensive listing of all the BR and PR/TT SIGADs as well as information on PR/TT data collected prior to November of 2009, contact your 
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organization’s management or subject matter expert. 


(TS/SI/INF) Since it is possible that one communication event will be collected under multiple collection authorities (and multiple collection sources), not all 
of the results will be unique to one collection authority (or collection source). Keep in mind that the classification at the beginning of each result only 
indicates the hiahest level classification of that result. and does not necessarily reflect whether a result was uniaue to one collection authoritv (or collection, _ 


WG eeu wee eben water mules A (or eee. Wau Bee Nore |comment [SLS10]: Note for audio recording, 
Here are examples of results originating from multiple collection sources. None of these results are considered BR- or PR/TT- 


the acronym PDDG should be spelled out in letters 
“P D D G” followed by the word “SIGAD” -- so this 
phrase will be recorded as “Producer Designator 
Digraph, or PDDG or SIGAD” 


Comment [a11]: Screenshot 
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Page Classification 
TOP SECRETHCOMINTINOEORN 


DATE/PREPARER: Topic Screen Number 
(FSHSHANE) BR or PRAT 12 of 27 
Unique Query Result 


(FSHSHANE) What is a BR- or PR/TT-Unique Query Result? 


FRAME ID: 4090 


(U) (Insert image of OGC Attorney and HMC Character sitting at a table discussing the 


talking points below shown on a white board) 
NEXT FRAME ID: 4100 


(FSHSH/NE) BR- or PR/TT- “unique” query results are those contacts within a chain 
solely derived from the BR or PR/TT metadata and not duplicated in the results originating 
from any other authorities. 


BACK FRAME ID: 4080 
ALT TAG: 


GRAPHIC/AV, 


(U) Look at notes and match 


transcript to screen shots. 


(FSHSIHNE) (HMC Character): In the examples we just discussed, none of the results were unique to any one collection authority. Frequently, however, 
you'll find that some of the results within the chain are unique to one particular collection authority. A BR- or PR/TT-unique query result is any piece of 

information that NSA would not have had but for the BR or PR/TT metadata from which it was drawn. In other words, BR or PR/TT was the ONLY source of 
that individual contact/query result. 


(FSHSIYNE) Here are some examples: example A is “E.O. 12333-unique,” while B is “PR/TT-unique,” and C is “BR-unique. ’ 


Comment [a12]: Again show previous examples. 


Comment [SL$13]: Note for audio recording: 
we will want some time in between saying example 
A is “E.O. 12333-unique,” and while B is 
“PR/TT-unique,” and and C is “BR-unique.” 
to allow learner to look at the examples. Please 
allow some “quiet” space that can be duplicated 
to the amount of time needed. THANKS! © 


(FSHSIHNE) Sharing restrictions in the FISC Orders only apply to unique BR or PR/TT query results. If query results are derived from multiple sources and 
are not unique to BR and PR/TT alone, the rules governing the other collection authority would apply. We will discuss these sharing and handling 
restrictions in greater depth shortly. 
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DATE/PREPARER: Topic Page Classification Screen Number 
(FSHSHANF) BR or PR/TT TOP SECGRETHSOMINTINSFORN 13 of 27 
Unique Query Result 


FRAME ID: 4100 
(FSHSHNE) BR or PR/TT Query Results — Not Just a Line Within a Chain 


(FSYSH/NE) Examples of BR and/or PR/TT Query Results include: 


NEXT FRAME ID: 4105 A specific identifier 
“Identifier A was in contact with Identifier B” 


A .cml file (i.e. the entire contact chain/result set) that contains BR or PR/TT query 
BACK FRAME ID: 4090 results 


A written or electronic depiction of a chain (i.e., the .cml file itself) or the analysis or 
partial analysis of a chain that includes BR or PR/TT results 

GRAPHIC/AV: A compilation or summary of first- and second-level contacts from a RAS-approved 
seed 

A draft or a finished but not yet disseminated report 

Any other BR or PR/TT information returned following a RAS-approved federated 


query 


ALT TAG: 
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FOR SECREHASHNOFORN 


(FSHSHNE) (OGC Attorney): Before we discuss sharing and handling restrictions of BR- and PR/TT-unique query results, it is important to understand that 
a BR or PR/TT query result is not just a line within the chain that is presented to you after you run a BR or PR/TT query in EEE Any information that 
you derive, extract, or manipulate from that particular line in the chain becomes a BR or PR/TT result. Given that a source of the result is derived from BR 
or PR/TT metadata, any adaptation of that result, including information provided orally or in writing, even a tip or a lead, remains a BR or PR/TT query 
result. 


(FSHSIZNF) (OGC Attorney): In addition, other examples of items that have been deemed to be BR and PR/TT query results include: 
e A specific identifier 
e “Identifier A was in contact with Identifier B” 
©. A Bie (for example the entire contact chain/result set) that contains BR or PR/TT query results 
A written or electronic depiction of a chain (like the Bie itself) or the analysis or partial analysis of a chain that includes BR or PR/TT results---- 
A compilation or summary of first- and second-level contacts of a RAS-approved seed 
A draft or a finished but not yet disseminated report 


Any other BR or PR/TT information returned following a RAS-approved federated query 


4FORSECREHASLENOFORS 
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Comment [SLS14]: Note for audio recording, 
the SMEs would like for this to be pronounced “the 


file” — I know thi 
since we don’t say things 


s might sound a little odd 
ike “the dot p d f file” but 


just trust me on this one because we had a 5 minute 


argument about it in a SMI 


E meeting. UGH! 


DATE/PREPARER: Topic Page Classification Screen Number 
(FSHSHANF) BR or PR/TT TOP SECGRETISOMINTINOSESRN 14 of 27 
Unique Query Result 


FRAME ID: 4105 


(FSHSHANE) BR or PR/TT Query Results — Not Just a Line Within a Chain 


NEXT FRAME ID: 4110 


BACK FRAME ID: 4100 
ALT TAG: 


GRAPHIC/AV: 


(FSHSWHNE) (HMC Character): So, for example, if you run a BR or PR/TT query on a particular RAS-approved e-mail identifier and it returns information 
that depicts identifier A, the RAS-approved seed, was in direct contact with identifier B and the source of the metadata is BR or PR/TT, then just the fact 
that identifier A is communicating with identifier B is considered a BR or PR/TT query result. 


(FSHSHNE) (HMC Character): In addition, any summary of that information would also be a BR or PR/TT query result. So, if you knew that identifier A 
belonged to Joe and identifier B belonged to Sam, and the fact of that contact was derived from BR or PR/TT metadata, if you communicate orally or in 
writing that Joe talked to Sam, even if you don't include the actual e-mail account or telephone numbers that were used to communicate, this is still a BR or 
PR/TT query result. 


(FSHSIANE) (OGC Attorney): Remember, if these results are determined to be BR- or PR/TT-UNIQUE, they are subject to sharing and handling 
restrictions. 
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DATE/PREPARER: Topic Page Classification Screen Number 
(TS/H/SU/NF) Sharing and FOR 15 of 27 
Handling Restrictions of BR or SEGRETHICOMINTANOFORN, 
PR/TT Unique Query Results 


FRAME ID: 4110 


(TS4SWNE) Sharing and Handling Restrictions of BR- or PR/TT-Unique Query 


Results 


(FSHSIJNE) Examples of handling restrictions for BR and PR/TT unique query 
results: 
s Any document, .cml, or other file containing BR- or PR/TT-unique information may 
only be stored on the analyst’s personal folders, or an access-controlled, shared 


BACK FRAME ID: 4105 location 
; Query results can y system where the results would be shared with 
peer individuals vithout oo 


GRAPHIC/AV: BR- or PR/TT-unique results may not be queried j user queries are 
visible to other analysts (who may not — <; can be 
manipulated by behind the scenes analytics Comment [a15]: Where is no such list af tools 
m that are ok; not ok te query, btw. 
(TS#SINF) These restrictions apply to information that is SOLELY unique to BR and 
PR/TT and do NOT apply to information which is NOT unique to BR or PR/TT! 


(FSHSIANE) (OGC Altorney): Remember, BR- or PR/TT-unique query results are those contacts within a chain solely derived from the BR or PR/TT 
metadata and not duplicated in the results originating from any other authorities. Any oral or written depiction, manipulation, or summary containing that 
information is also a unique query result. Until they are officially disseminated, BR- or PR/TT-unique results may only be shared with individuals who hold 
the proper credentials to receive ar view BR or PR/TT information. The requirement is imposed because of the special handling restrictions that we will 
discuss later in this Module. Without the proper training, the FISC-imposed handling restrictions may not be followed. 


NEXT FRAME ID: 4120 


(FSHSHNE) (HMC Character} Unless these unique results have been disseminated, such BR- or PR/TT-unigue information may only be shared with 
individuals who have the proper credentials to receive or view BR or PR/TT information. Remember, use pap determine a user's credentials. This--| Comment [SLS16]; Xote for audio recording, 
means: lis is pronounced 

a Any document, or other file containing BR- or PR/TT-unique information may only be stored on the analyst's personal folders, or an access~| Comment [SL517]: Please say Eat) 
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controlled, shared location that is accessible to only BR and PR/TT cleared personnel. 
e Query results cannot be put into any system where the results would be shared with individuals without 
e BR- or PR/TT-unique results may not be queried in tools where user queries are visible to other analysts (who may not have or 


can be manipulated by behind the scenes analytics. If you have questions regarding which tools are acceptable to further researcn query results, 
please contact your management or technical director. 


(FSHSIANE) (SV Character) However, as we've discussed, not all BR or PR/TT results are unique. If a query result indicates it was derived from another 
collection source in addition to BR or PR/TT, the rules governing the other collection authority would apply to the handling and sharing of that query result. 
For example, this result came from both BR and E.O. 12333 collection; therefore, because it is not unique to BR information, it would be ok to inform non- 
BR cleared individuals of the fact of this communication, as well as task, query, and report this information according to standard E.O. 12333 guidelines. 


(FSHSIHNF) (SV Character) In summary, if a query result has multiple collection authorities, analysts should source and/or report the non-BR or PRATT 
version of that query result according to the rules governing the other authority. But if it is unique to either the BR or PR/TT authority then it is a unique 
query result with all of the applicable BR and PR/TT restrictions placed on it. In both cases, however, analysts should not share the actual chain containing 
BR or PR/TT results with analysts who do not have the credentials to receive or view BR or PR/TT information. In such an instance, if it is necessary to 
share the chain, analysts should re-run the query in the non-BR or non-PR/TT areas of and share that .cml. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Retention of Metadata FOP-SEGRETHCOMINTINOFORN 16 of 27 
and Query Results 


FRAME ID: 4120 


(U) Retention of Metadata and Query Results 


BR ae hae (FSHSHENF) NSA must destroy BR and PR/TT metadata no later than five years (60 


months) after initial collection 


BACK FRAME ID: 4110 (FSHSH/NF) The FISC has not imposed any destruction requirement on BR or PR/TT 
query results 


ALT TAG: 


GRAPHIC/AV: 

(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 

(FSHSHNE) Possible cutaway images may 
include: 

e image depicting notional storage of 
bulk metadata and U.S. person 
information and then the 
destruction/deletion of the 
metadata 
image depicting the retention of BR 
and PR/TT query results 


(FSHSIHNE) (OGC Attorney): The Court Orders mandate destruction of the metadata five years or 60 months after initial collection. NSA destroys the BR 
and PR/TT metadata no later than five years after collection. There are no exceptions to this requirement when it comes to the bulk metadata. 


(FSHSHINE) (HMC Character): The destruction requirement applies to the bulk metadata; it does not apply to query results that have been generated as a 
result of queries of RAS-approved identifiers. Once we have queried the metadata we have selected metadata, or query results, and the 60-month cutoff 
does not apply. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Knowledge Check 2 TOP SECRETICOMINTINOEORN 17 of 27 


FRAME ID: 4130 (U) Knowledge Check 2 


3. (FSHSIANF) Please complete the following sentence. The Emphatic Access Restriction (EAR) 


NEXT FRAME ID: 4135 a) creates an automatic auditable record to allow for oversight of these authorities. 
alerts mmm Wen an individual without mattempts to conduct a 


query. a 
forwards the query request to the HMC for approval. 


BACK FRAME ID: 4120 prohibits non-RAS-approved identifiers from being queried in Ez, 
None of the above. 
ALT TAG: 


4. (FSHSHANF) Assuming that the following answers describe unique BR or PR/TT query results, which of the 


GRAPHICIAV: following could be shared with co-workers who do not have 
a) Having a fellow analyst review the draft of a report that contains PR/TT-derived information 
b) Asummary of direct or indirect contacts of a RAS-approved identifier 
c) Telling your manager that contacted as 
noted in the PR/TT query you recently performed 
d) E-mailing an electronic depiction of a BR or PR/TT contact chain or a pattern 
e) None of the above. 


5. (FSHSWNE) TRUE or FALSE: If a query result indicates that the source of information is both Executive 
Order 12333 collection and PR/TT collection, then the analyst must handle the E.O. 12333 result according 
to the PR/TT rules. 

a) True 

b) False 


(U) (HMC Character): Let’s make a few notes in our travel journal and check to see what you remember from this topic! 
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ANSWERS: 
Question 3. (FSHSHINF) Correct! The EAR prohibits non-RAS-approved identifiers from being queried in 
(FSHSHNE) Incorrect. The correct answer is d). The EAR prohibits non-RAS-approved identifiers from being queried nM 


Question 4. (FS#SHNE) Correct! None of the examples listed should be shared with anyone outside of channels. 

(FSHSHNE) Incorrect. The correct answer is e). None of the examples listed should be shared with anyone outside of channels. 
Question 5. (FSHSH/NF) Correct! Ifa PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 
collection and follows the E.O. 12333 processes and procedures. 


(FSHSIHNEF) Incorrect. If a PR/TT query result can also be sourced to Executive Order 12333, then the information is considered E.O. 12333 collection and 
follows the E.O. 12333 processes and procedures. 


FORSECRIE-SHANGEORN 
Page 25 of 39 


DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Knowledge Check 2 FOP SECRETICOMINTINOEORN 18 of 27 


FRAME ID: 4135 (U) Knowledge Check 2 


6. (TSS NP) |f i s your RAS-approved identifier, and he e-mails 
3 how many hops is from your RAS-approved 
NEXT FRAME ID: 4140 identifier? Are you allowed to chain that far in the PR/TT mode of I I? 


4 hops, no, unless one of the contacts between B n- = $ RAS 


approved. 


BACK FRAME ID: 4130 3 hops, no (unless one of the contacts between and a: 


RAS approved). 
ALT TAG: 4 hops, yes. 


3 hops, no. 
GRAPHIC/AV: 2 hops, yes. 


7. (FSHSHNE) If Badguy1’s identifier is RAS-approved, and he calls Associate1, who then calls 
Unknownguy, who then calls Unknownguy2, how many hops | kngwnguy2 from your RAS-approved 
identifier? Are you allowed to chain that far in the BR mode o 


a) 4hops, no, unless one of the contacts between badguy1 and unknownguy2 is RAS 
approved. 
3 hops, yes (with management approval). 
4 hops, yes. 
3 hops, no. 
2 hops, yes (with management approval). 


(No audio or transcript on this page) 
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ANSWERS: 
Question 6. (FSHSIANF) Correct! The 
far unless one of the contacts between 
(FSHSHANE) Incorrect. The correct answer Is b). Ihe 
permitted to chain this far unless one of the contacts 


is 3 hops from the RAS 


-approved identifier. You would not be permitted to chain this 
is RAS approved. 

dig from the R&S-approved identifier. You would not be 

is RAS approved. 


Question 7. (FSHSIZNEF) Correct! The = : 3 hops from the RAS-approved identifier. You are permitted to chain this far with management 
approval. 


(FSHSIHNF) Incorrect. The correct answer is b). The £ 3 hops from the RAS-approved identifier. You are permitted to chain this far with 
management approval. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(FSHSHANF) Dissemination of BR FOP-SECRETHICOMINTINOFORN 19 of 27 
and PR/TT Derived Information 


FRAME ID: 4140 


(FSHSIZNF) Dissemination of BR- and PR/TT-Derived Information 


(FSHSHANF) Dissemination of BR and PR/TT results is distributing information to external 


customers in any form to include oral or written form 
NEXT FRAME ID: 4150 


(FSHSHENF) Topics covered: 
Information of foreign intelligence value which contains only foreign person information 


BACK FRAME ID: 4135 that IS NOT unique to BR or PR/TT 


Information on U.S. persons (minimized) or foreign target activity unique to BR or PR/TT 
ALT UAG metadata 


GRAPHIC/AV: Information on U.S. persons (unminimized) unique to BR or PR/TT 
(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at 
a table 
(U) Possible cutaway images may 
include: 
e Sharing of information outside 
of NSA (perhaps with FBI or 
other customer 


(FSHSIHNEF) (OGC Attorney): Now let’s focus our attention on the dissemination of BR and PR/TT results. We define dissemination of BR and PR/TT 
results as distributing information to external customers in any form to include oral or written form. Let’s say you perform a BR or PR/TT query using a 
RAS-approved identifier, and the query returns good foreign intelligence information based on unique BR or PR/TT metadata that you would like to report 
to Intelligence Community customers. What should you do? In this topic we will discuss to what extent we can use standard processes and procedures for 
the dissemination of this information and to what extent we must use special processes and procedures for the dissemination of this special foreign 
intelligence information. Given the sensitive nature of this Program, you will not be surprised to hear that there are special rules that apply to the 
dissemination of this information. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
{FSHSIYNF} Dissemination of BR- and FOR 20 of 27 
PR/TT-Derived Information SEGRETICOMINTASIOEORA 


FRAME ID: 4150 
{TSYSVINF) Information Derived Exclusively from BR or PR/TT — Additional Requirements 


CFSHSI/NF) Standard reporting practices and policies (including sourcing requirements and 
NEXT FRAME ID: 4160 procedures and USSID SP0018 minimization) apply to BR and PR/TT query results 


€FSHSH/NF) Two additional, BR- and PR/TT-specific requirements: 
+ The Counterterrorism (CT) nexus requirement applies to BR- and PR/TT-derived 


ALT TAG: unminimized U.S. person information, but does not apply to BR- or PR/TT-derived non- 
Aeon U.S. person information or BR- or PR/TT-derived minimized U.S. person information 
(U) Image of OGC Attorney, HMC e The dissemination tracking requirement applies to all BR- and PR/TT-derived 


Character, and SV Character sitting information 
at a table 


{FSHSHNS (OGC Attorney): First of all, every disseminated report from NSA must include sourcing information so that we know where the information 
came from, as well as follow all USSID SP0018 minimization requirements and procedures. For BR- and PR/TT-derived information, the analyst or reporte Comment [SLS18]: UPDATE 7/13/11 from the 


needs to make sure that the information included in that report is properly sourced to the appropriate BR or PR/TT authority. SMEs: Please record at USSID 18 (do not say SPEW 
or SPOW, just “USSID 18” 


{FSHSIHNE) In addition, the Court Orders for both the BR and PR/TT authorities have imposed two unique, stringent requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus requirement, and the second is the dissemination tracking 
requirement. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
CPSHSIANE} The CT FER-SECRETHIGOMAHTHRGRORA, 21 of 27 
Nexus Requirement 


FRAME ID; 4160 


{TSHSHNE The CT Nexus Requirement 


(FSHSHANF) Prior to the dissemination of BR- or PR/TT-derived unminimized U.S. person 


dare tN AAIE information outside of NSA, one of the designated approval authorities must determine: 


(a) that the U.S. person information is related to CT information, and 


pepe ADE ail Wee ila! (b) that the U.S. person information is necessary to understand the CT information 


ALT TAG: or to assess its importance 


GRAPHICIAV: 

(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 

CFSHSIANE) Image to explain the CT Nexus 


CPSHSIZNE} (OGC Attorney): The CT nexus requirement applies only to U.S. person information. If you run a query and the information returned is all 

foreign person information, then the CT nexus requirement does not apply to this situation. However, if your query results include U.S. person information 

derived from BR or PR/TT and you want to disseminate that information to an external customer, such as the FBI, then this requirement must be met prior 

to dissemination, in any form. Traditionally, under USSID SP0018, if there is a piece of unminimized U.S. person information that you would like to ____...---f Comment [SLS19]: UPDATE 713411 from the 
disseminate, one of the designated approval authorities (to be covered on the next screen) needs to determine that the information is necessary to SMF: Please record at USSTT) 18 (de not say SPEW 
understand the foreign intelligence in that particular intelligence report before the information can be released. For BR and PR/TT, the requirement is SEC Ee 

slightly different. 


CPSHSIANE} (OGC Attorney): With respect to the BR and PR/TT authorities, the unminimized U.S. person information not only has to relate to and be 
necessary to understand the foreign intelligence information in the report, but it has to relate to and be necessary to understand the Counterterrorism 
information. 
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{FSHSHINE) (HMC Character): Recall the RAS process and how you derived this information. The identifier you used to wenerate this information was 
approved based upon the RAS standard. It was found to be an identifier reasonably believed to be used by someonell 


CPSHSIHNE) (HMC Character): It might seem as though the information would most certainly be counterterrorism-related since, due to the RAS approval 
process, you wouldn't have this U.S. person information from a query of BR or PR/TT if it weren't related to counterterrorism. In the majority of cases, it will 
be counterterrorism-related; however, the nature of the counterterrorism target is that it often overlaps with several other areas that include 
counternarcotics, counterintelligence, money laundering, document forging, people and weapons trafficking, and other topics that are not CT-centric. Thus, 
due to the fact that these authorities provide NSA access to a high volume of U.S. person information for counterterrorism purposes, the Court Order 
requires an explicit finding that the information is in fact related to counterterrorism prior to dissemination. Therefore, one of the approved decision makers 
must document the finding using the proper terminology. It must state that the information is related to counterterrorism and that it is necessary to 
understand the counterterrorism information. 


FFSHSIHNF}-(OGC Attorney): While the USSID SP0018 process is the most familiar method of governing the dissemination of unminimized U.S. person 
information obtained from traditional SIGINT means, the CT nexus requirement is an additional protection for U.S. person information being disseminated 
when the BR or PR/TT authorities, and metadata obtained by virtue of those authorities, is the source of the information. The FISC wants to ensure that the 
authorities are being used for counterterrorism purposes as intended, so consider the CT nexus requirement a step above justifying a foreign intelligence 
requirement. 
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DATE/PREPARER: 11/23/2010 SLS 


Screen Number 
22 of 27 


Screen 
(U) Dissemination 
Requirements 


Page Classification 
TOR SECREHIGOMIAHHNGFORN 


FRAME ID: 4170 
(FS4SIENE) Dissemination Approval Authorities 


CFSHSIENF) Only those in the following NSA positions have the authority to approve the 


NEXT FRAME ID: 4180 dissemination of BR- or PR/TT-derived U.S. person(s) information: 


(U) USSID SP0018 


BACK FRAME ID: 4160 (U#EOUO) The Chief and Deputy Chief of Information Sharing Services 
(U#FOUO) The Senior Operations Officers (SOOs) of the National Security 
Operations Center (NSOC) 
Titania MTNS (U#FOUC) The Director and Deputy Director of the Signals Intelligence Directorate 
mage ọ mey, 


Character, and SV Character sitting at a (U#FOUO) The Director and Deputy Director of NSA 
table 


ALT TAG: 


(U) This approval authority cannot be delegated to anyone else! 


(TSHSIANE) (OGC Attorney): Certain positions are authorized to validate the CT nexus requirement, as we just discussed, and approve the dissemination 
of U.S. person(s) information that we obtain from these two authorities. 


(FSHSIANE) (OGC Attorney): Recall from your USSID $P0018 training. there are certain positions at NSA which have the authority to approve the 
dissemination of information that would identify a U.S. person either by name or by context. Those positions are listed in USSID SP0018 and include the 
Chief and Deputy Chief of the Information Sharing Services Office, the Senior Operations Officers S00) within the National Security Operations Center--| Comment [SL$20]: Note for audio recording, 


(NSOC}, the Director and Deputy Director of the Signals Intelligence Directorate (SID), and in some cases they include the Director and Deputy Director oj this is pronounced as a word “SOO” (rhymes with 
NSA “sew” but does not riyme with “sew a dress”) 


s, A 3 ; FN) Ae á ` : ; Comment [SLS21]: Note for audio recording, 
(FSHSWHNE) (HMC Character): The list of positions which can approve the dissemination of unminimized U.S. person information derived from unique BR | this is pronounced “ sock” 
and PR/TT query results is the same as those named in USSID SP0018. 
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(FSHSHNE) (OGC Attorney): It is important to note that the authority to approve the dissemination of U.S. person information cannot be delegated. This 
responsibility is assigned only to the positions named in the BR and PR/TT Court Orders. Let's say, for example, that the Chief and Deputy Chief of 
Information Sharing Services Office, the two individuals who on a normal daily basis would be making the decision, are both on vacation on the same day. 
In this instance, someone else within their office may be the acting chief on that day; however, the acting chief cannot make the decision to disseminate 
U.S. person information. 


(FSHSIANF) (HMC Character): Under these circumstances, if information about a U.S. person must be disseminated on that day, then you should send 
your dissemination request to one of the other positions named in the Orders. This would logically be the NSOC SOO. 


(FSHSIZNF) (OGC Attorney): With respect to non-U.S. person information, standard NSA practices and policies (such as proper sourcing information) 
apply. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Dissemination FOR-SECRETICOMIN THINS EORN 23 of 27 
Requirements 


FRAME ID: 4180 
(U) Dissemination Tracking 


NEXT FRAME ID: 4190 
(FSHSH/NF) NSA must report to the FISC every 30 days the number of instances since the 


preceding report in which NSA disseminated BR- or PR/TT-derived information, in any 


BACK FRAME ID: 4170 i 
form (oral, written, formal, or informal), with anyone outside of NSA 


ALT TAG: 


GRAPHIC/AV: (U) For more information, please contact D 


(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 
(U) Possible cutaway images may include: 
e Image demonstrating the preparing 
and delivering of a report to the 
FISC 


(FSHSIZNF) (OGC Attorney): The other requirement, which applies to both U.S. person information as well as foreign person information, is the 
dissemination tracking requirement regarding the dissemination of BR- and PR/TT-derived information. The Orders require NSA to track and report to the 
FISC every instance in which NSA disseminates any information derived from either of these two authorities. 


(FSHSHNE) (HMC Character): This refers to information disseminated in a formal report as well as information disseminated informally such as written or 
oral collaboration with the FBI. We need to count every instance in which we take a piece of information derived from either of these two authorities and 
disseminate it outside of NSA. 


(FSHSHINE) (HMC Character): Normally an NSA product report is the record of a formal dissemination. In the context of the BR and PR/TT Programs, an 
official RFI response or Analyst Collaboration Record will also be viewed as dissemination. Because this FISC requirement goes beyond the more standard 
NSA procedures, additional diligence must be given to this requirement. NSA is required to report disseminations formal or informal to the FISC every 30 
days. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Dissemination FOP_SEGRETHCOMINTINOEORN 24 of 27 
Requirements 


FRAME ID: 4190 


(U) Post-Dissemination Restrictions? No, Restrictions lifted once Disseminated 


(FSHSHANF) Once approved for dissemination, BR- or PR/TT-derived information can be 


NEN PRAWIE IPE <20 used within NSA for any lawful purpose, and the sharing restrictions no longer apply 


BACK FRAME ID: 4180 
ALT TAG: 


GRAPHIC/AV: 
(U) Image of OGC Attorney, HMC 
Character, and SV Character sitting at a 
table 
(U) Possible cutaway images may include: 
e |mage that portrays the lifting of the 

sharing restriction once information 

is approved for dissemination 
(FSHSIZNF) (OGC Attorney): Once BR and PR/TT information has been disseminated (such as in a product report, RFI, or briefing), generally speaking, 
there are no follow-on restrictions that either NSA or our customers need to follow regarding the sharing or dissemination of that information contained in 
the report. The Orders do not impose any restrictions on the use of formally reported information from the BR or PR/TT authorities; therefore, this 
information can be used for any lawful purpose. 


(FSHSIANE) If BR- or PR/TT-derived information is disseminated outside of NSA, then the restrictions on internal sharing of that same information at NSA 
no longer apply. For CX }_jtii—__—sseminated can be shared outside of HE channels, and the identifiers can be used in 
other tools such as the 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Knowledge FOP SEGRETICOMINTYNOESRN 25 of 27 
Check 3 


FRAME ID: 4200 (U) Knowledge Check 3 
A 8. (FSHSIANEF) Identify the additional requirements regarding the dissemination of unminimized U.S. person 
NEXT FRAME ID: 4210 information derived from BR or PR/TT information: 
. The Counterterrorism nexus check 


. The Counterintelligence nexus check 
BACK FRAME ID: 4190 . The dissemination tracking requirement 
; . The sourcing requirement 
ATAG: . Both a) and c) 
GRAPHIC/AV: 
9. (FSHSIENF) TRUE or FALSE: the dissemination tracking requirement applies to only U.S. person BR- or 
PR/TT-derived information. 


a. TRUE 
b. FALSE 


(U) (OGC Attorney): Before we move on to the next part of our trip, let’s make a few notes in our travel journal. 


ANSWERS: 

Question 8. FSHSH/MF) Correct! The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with respect to 
disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person information), and 
the second is the dissemination tracking requirement. 

(FSHSHANE) Incorrect, the correct answer is e). The Court Orders for both the BR and PR/TT authorities have imposed two unique requirements with 
respect to disseminating information from these authorities. The first is the Counterterrorism, or CT, nexus check (which applies only to U.S. person 
information), and the second is the dissemination tracking requirement. 


Question 9. FSHSH/NEF) Correct! The dissemination tracking requirement applies to both U.S. person and non-U.S. person BR- and PR/TT-derived 
information. 
(FSHSIANE) Incorrect. The dissemination tracking requirement applies to both U.S. person and non-U.S. person BR- and PR/TT-derived information. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
Knowledge FOP SEGRETICOMINTYINOESRN 26 of 27 
Check 3 


FRAME ID: 4210 (U) Knowledge Check 3 


10. (FSHSIANE) For the purpose of the BR and PR/TT Programs refers to the distribution of 
information to customers in any form. is the provision of BR and PR/TT FISA query results with 
NEXT FRAME ID: 4220 others inside of NSA authorized to receive BR and PR/TT query results. 
a) Dissemination, Distribution 
b) Sharing, Dissemination 
c) Dissemination, Sharing 


BACK FRAME ID: 4200 d) Sharing, Distributing 


ALT TAG: 11. (FSHSIYNE) Which one of the following NSA positions does not have the authority to approve the 
: dissemination of BR- or PR/TT-derived unminimized U.S. person information? 
GRAPHIC/AV: a) The SOOs in the NSOC 


b) The Director and Deputy Director of the Signals Intelligence Directorate 
c) The Director and Deputy Director of NSA 

d) The Office of General Counsel (OGC) 

e) The Chief and Deputy Chief of Information Sharing Services 


(No audio or transcript on this page) 


ANSWERS: 

Question 10. (FSHSHANF) Correct! Dissemination is the more formal distribution of information to customers in either oral or written form. Sharing is the 
provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 

(FSHSIHNEF) Incorrect. The correct answer is c) Dissemination is the more formal distribution of information to external customers in either oral or written 
form. Sharing is the provision of BR and PR/TT FISA query results with others inside of NSA authorized to receive BR and PR/TT query results. 


Question 11. CFSHSH/NE) Correct! The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized 
U.S. person information. 

(FSHSHYNE) Incorrect. The answer is d) The OGC does not have the authority to approve the dissemination of BR- or PR/TT-derived unminized U.S. 
person information. 
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DATE/PREPARER: 11/23/2010 SLS Topic Page Classification Screen Number 
(U) Summary TOP SECRETICOMINTUNOFORN 27 of 27 


FRAME ID: 4220 


(U) Now that we have completed this part of your trip you should be able to: 
e (FS4SHAEF) Distinguish between the analysts authorized to query BR and PR/TT 
metadata and those authorized to view query results 
NEXT FRAME ID: WA (FSHSHANF) Recognize the contact chaining restrictions for RAS-approved 
identifiers 
(FSHSHANF) Recognize what constitutes unique BR and PR/TT query results 
BACK FRAME ID: 4210 (FSHSHANEF) Identify limitations that impact access, sharing, dissemination and 
retention of BR and PR/TT query results 
(FSHSHANF) Recognize the BR and PR/TT dissemination tracking requirement and 


ALT TAG: 


GRAPHIC/AV: the additional CT nexus requirement for U.S. person identifiers 
(U) Image of OGC Attorney, HMC 

Character, and SV Character sitting at a 

table 


(FSHSIZNF) (OGC Attorney): Remember, you are responsible for ensuring that the recipient of query results is authorized to receive these results. Also, 
you must be mindful of the special restrictions for dissemination, either oral or written, of the BR- and PR/TT-derived information. 


(U) (OGC Attorney): Now that we have completed this part of the trip you should be able to: 
(FSHSH/NE) Distinguish between the analysts authorized to query BR and PR/TT metadata and those authorized to view query results 
(FSHSHINE) Recognize the contact chaining restrictions for RAS-approved identifiers 
(FSHSHNE) Recognize what constitutes unique BR and PR/TT query results 
(FSHSHANE) Identify limitations that impact access, sharing, dissemination, and retention of BR and PR/TT query results 
(FSHSH/ME) Recognize the BR and PR/TT dissemination tracking requirement and the additional CT nexus requirement for U.S. person identifiers 


FOPSEEREHSHNOFORN 
Page 38 of 39 


U.S. person X 


Minimized U.S. person Info 
“U.S. Person #1” 


Foreign Person 
“John Doe” 
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